Description
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frostming | unearth | ≤ 0.18.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | unearth | 0.18.3-1 | — |
| Debian 13 | unearth | No fix yet | — |
| Debian 12 | unearth | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | unearth | No fix yet | — |
| Ubuntu 24.04 LTS | unearth | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-unearth | 0.18.3-1.1 | openSUSE-SU-2026:11541-1 |
| openSUSE Leap 16.0 | python-unearth | 0.17.3-bp160.2.1 | openSUSE-SU-2026:21606-1 |
Advisories 2
- openSUSE-SU-2026:21606-1 Security update for python-unearth SUSE / openSUSE Security Updates · Aug 21, 2026
- openSUSE-SU-2026:11541-1 python313-unearth-0.18.3-1.1 on GA media SUSE / openSUSE Security Updates · Aug 19, 2026
References
- Researcher Disclosure technical-description exploit issue-tracking
- Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/unearth-path-traversal-via-unnormalized-paths-and-symlink-escape third-party-advisory